Reading the bits
A wildcard mask says which bits of an address a rule has to match. Cisco documents it this way: each 0 means the bit must match exactly, and each 1 means the bit can be ignored. With the pair 192.168.10.0 0.0.0.255, the first three octets must match and the last can be anything, so the rule covers the whole /24.
To get a wildcard from a subnet mask, subtract the mask from 255.255.255.255 octet by octet. That's the same as flipping every bit. A few pairs:
- /16: mask 255.255.0.0, wildcard 0.0.255.255
- /22: mask 255.255.252.0, wildcard 0.0.3.255
- /24: mask 255.255.255.0, wildcard 0.0.0.255
- /26: mask 255.255.255.192, wildcard 0.0.0.63
- /28: mask 255.255.255.240, wildcard 0.0.0.15
- /30: mask 255.255.255.252, wildcard 0.0.0.3
The Subnet Calculator shows the wildcard next to each mask, so you can paste the pair straight into a config.
Where you meet it
Cisco IOS access lists take a wildcard after the address, and two shortcuts are worth knowing. A wildcard of 0.0.0.0 matches one exact address, so 10.1.1.2 0.0.0.0 is the same as host 10.1.1.2. The pair 0.0.0.0 255.255.255.255 matches everything and is written any.
OSPF network statements use a wildcard too. It picks which interfaces join an area, by matching their addresses against a range.
AWS and Azure subnets are written in CIDR, so you only reach for a wildcard when you configure a Cisco style access list or routing statement.
Patterns a subnet mask can't express
A wildcard is a free pattern, so its 1 bits don't have to sit at the end. The wildcard 0.0.0.254 applied to 10.10.10.2 matches every even address from 10.10.10.0 to 10.10.10.254, and applied to 10.10.10.1 it matches the odd ones. No prefix length can write that. That makes a wildcard useful for grouping hosts that no single subnet covers.
For ordinary blocks the wildcard just follows the block size. A /22 that starts at 10.4.0.0 spans 4 /24 networks, so its wildcard is 0.0.3.255 and its usable hosts run 10.4.0.1 to 10.4.3.254.